@jini-ai/daemon 0.6.19 → 0.6.23

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.6.23
+
+- Security hardening.
+
+## 0.6.22
+
+- Child stdout can be framed and sanitized line by line before parsing. A timed-out or cancelled delegated tool can report host-loaded recovery facts through `recoverInterruptedTool`, with no retry.
+
 ## 0.6.19
 
 - `DelegatedToolsHttpDeps.toolRegistry` takes a list-only registry view (`Pick<ToolRegistry, 'list'>`): the route only reads descriptors, and hosts pass descriptor-only facades.

package/dist/agent-executor/codex/home-config.d.ts

@@ -1,4 +1,4 @@
-import type { McpHttpEndpoint, McpJsonServerEntry } from '../contracts.js';
+import type { McpHttpEndpoint, McpJsonServerEntry, McpJsonInjectionOptions } from '../contracts.js';
 /** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
 export declare function tomlKey(key: string): string;
 /**
@@ -16,8 +16,9 @@ export declare function tomlKey(key: string): string;
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export declare function buildCodexMcpServerToml({ entry }: {
+export declare function buildCodexMcpServerToml({ entry, toolApprovalOwner }: {
     readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
+    readonly toolApprovalOwner?: McpJsonInjectionOptions['toolApprovalOwner'];
 }, _options?: {}): string;
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
@@ -42,10 +43,11 @@ export declare function buildCodexMcpServerToml({ entry }: {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
+export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings, toolApprovalOwner }: {
     readonly existingRaw: string | undefined;
     readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
     readonly inheritUserMcp?: boolean;
     readonly inheritUserSettings?: boolean;
+    readonly toolApprovalOwner?: McpJsonInjectionOptions['toolApprovalOwner'];
 }, _optional?: Record<string, never>): string;
 //# sourceMappingURL=home-config.d.ts.map

package/dist/agent-executor/codex/home-config.js

@@ -56,12 +56,13 @@ const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export function buildCodexMcpServerToml({ entry }, _options = {}) {
+export function buildCodexMcpServerToml({ entry, toolApprovalOwner }, _options = {}) {
+    const approval = toolApprovalOwner === 'host' ? 'default_tools_approval_mode = "approve"\n' : '';
     if ('url' in entry)
-        return buildCodexHttpMcpServerToml({ endpoint: entry });
+        return buildCodexHttpMcpServerToml({ endpoint: entry }, { approval });
     const argsLiteral = entry.args.map(tomlString).join(', ');
     const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
-        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n${approval}`;
     const envLines = Object.entries(entry.env)
         .filter((pair) => typeof pair[1] === 'string')
         .map(([key, value]) => `${tomlKey(key)} = ${tomlString(value)}`);
@@ -73,9 +74,9 @@ export function buildCodexMcpServerToml({ entry }, _options = {}) {
  * @returns One HTTP table using the existing timeout and TOML escaping owner.
  * @complexity O(endpoint bytes), without I/O.
  */
-function buildCodexHttpMcpServerToml({ endpoint }, _options = {}) {
+function buildCodexHttpMcpServerToml({ endpoint }, { approval = '' } = {}) {
     return `[mcp_servers.${JINI_MCP_SERVER_KEY}]\nurl = ${tomlString(endpoint.url)}\n` +
-        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n${approval}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
         `Authorization = ${tomlString(`Bearer ${endpoint.token}`)}\n`;
 }
 /**
@@ -213,10 +214,10 @@ function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
+export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true, toolApprovalOwner }, _optional = {}) {
     const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
     const blockBreak = base.endsWith('\n') ? '\n' : '\n\n';
     const separator = base.length === 0 ? '' : blockBreak;
-    return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
+    return `${base}${separator}${buildCodexMcpServerToml({ entry, toolApprovalOwner })}`;
 }
 //# sourceMappingURL=home-config.js.map

package/dist/agent-executor/codex/home-staging.js

@@ -75,8 +75,8 @@ function resolveCodexHomeSeams(options) {
  * {@link prepareCodexHomeIfNeeded} stays the backstop for every blocked case.
  * @throws {@link CodexMcpIsolationError} when the run can't be isolated.
  */
-function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome }) {
-    const build = () => buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings: inheritUserConfig });
+function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome, toolApprovalOwner }) {
+    const build = () => buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings: inheritUserConfig, toolApprovalOwner });
     if (inheritUserMcp)
         return build();
     const path = join(sourceHome, 'config.toml');
@@ -115,7 +115,7 @@ function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inherit
  * @complexity O(h) filesystem operations for h top-level user-home entries; one staged config write.
  * @overallScore 100/100
  */
-async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true) {
+async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true, toolApprovalOwner) {
     // Stricter than `@jini-ai/agent-runtime`'s `prepareAgentLogFile`/`preparePromptFileForAgent`
     // labels (which keep dots): this prefix stages a directory that ends up holding a copied Codex
     // login credential, so it gets `mcpJsonPathForRun`'s tighter discipline instead — dots stripped
@@ -133,7 +133,7 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, i
             // matching writeMcpJsonForRun's identical "missing file" handling.
             existingConfigRaw = undefined;
         }
-        const content = buildStagedCodexConfig({ existingRaw: existingConfigRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome: sourceCodexHomeDir });
+        const content = buildStagedCodexConfig({ existingRaw: existingConfigRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome: sourceCodexHomeDir, toolApprovalOwner });
         await seams.writeFile({ path: join(dir, 'config.toml'), content });
         await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, { inheritUserConfig });
     }
@@ -183,7 +183,7 @@ export async function prepareCodexHomeIfNeeded({ input, deps }) {
     }
     const inherit = codexInheritance(input);
     try {
-        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
+        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp, deps.mcpJsonInjection.toolApprovalOwner);
     }
     catch (err) {
         await deps.releaseStagedResources();

package/dist/agent-executor/contracts.d.ts

@@ -351,6 +351,10 @@ export interface McpHttpEndpoint {
     close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
 }
 export interface McpJsonInjectionOptions {
+    /** The trusted host owns authorization and human confirmation for bridge calls. Codex may
+     * approve the jini MCP transport without its own prompt; this grants no target-tool permission.
+     * Omission preserves the CLI's default approval behavior. Applies only to the jini bridge. */
+    readonly toolApprovalOwner?: 'host';
     /** Optional transport port. Reject before CLI launch when HTTP cannot be prepared.
      * The host keeps callback credentials in memory; only this endpoint capability reaches the CLI. */
     readonly prepareHttp?: (required: {

package/dist/agent-executor/events.d.ts

@@ -11,7 +11,7 @@ import type { ChildDrivenStreamFormat, TerminateChildTreeDeps, AgentCleanupFailu
 /** Default sink when a host does not supply `onCleanupFailure`: still observable, never silent. Redacted per SEC-007 (a spawn/permission error can embed paths/host detail). */
 export declare function defaultCleanupFailureSink(context: AgentCleanupFailureContext): void;
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -20,8 +20,8 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -101,13 +101,15 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw

package/dist/agent-executor/events.js

@@ -1,6 +1,7 @@
 import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
 import { createLiveSessionState } from './live-session-state.js';
+import { createSanitizedLineStream } from './sanitized-line-stream.js';
 import { acceptsMidRunUserMessages, createMessageRelay } from './message-relay.js';
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
@@ -186,7 +187,7 @@ function receivedJournalEntry(channel, content) {
     return { content, provenance: { source: 'agent', channel }, trust: 'untrusted' };
 }
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -195,8 +196,8 @@ function receivedJournalEntry(channel, content) {
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -283,13 +284,15 @@ function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw
@@ -364,12 +367,25 @@ export function wireChildLifecycle(ctx) {
     let bridgeChecked = !ctx.expectsJiniBridge;
     let bridgeUnavailable = false;
     // `def.stdoutPolicy` read once, up front, so the per-chunk handler below is a single boolean
-    // test rather than a repeated union narrowing. `undefined` (every def but antigravity) means
+    // test rather than a repeated union narrowing. `undefined` means
     // live — see this function's own doc.
     const stdoutPolicy = def.stdoutPolicy;
     const bufferStdoutUntilClose = stdoutPolicy?.buffering === 'until-close';
     const sanitizeBufferedStdout = stdoutPolicy?.buffering === 'until-close' ? stdoutPolicy.sanitize : undefined;
-    // Accumulator for the `'until-close'` path. Stays `''` for every live def, and the flush below
+    const lineStdout = stdoutPolicy?.buffering === 'line' ? createSanitizedLineStream({
+        maxBytes: ctx.bufferedStdoutMaxBytes, sanitize: stdoutPolicy.sanitize,
+        emit: ({ text }) => {
+            stdoutDiagnostics.feed({ text });
+            if (streamFormat === 'plain')
+                enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
+            else
+                streamHandler?.feed({ chunk: text });
+        },
+        onOverflow: ({ bytes }) => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'error', data: {
+                    message: bufferedStdoutTruncationNotice(bytes, ctx.bufferedStdoutMaxBytes),
+                } } })),
+    }) : undefined;
+    // Accumulator for the `'until-close'` path. Stays `''` for live and line policies, and the flush below
     // is then a no-op that emits nothing. Bounded by `ctx.bufferedStdoutMaxBytes` — see
     // {@link DEFAULT_BUFFERED_STDOUT_MAX_BYTES} for why an unbounded accumulator was a
     // denial-of-service surface rather than merely untidy.
@@ -647,6 +663,10 @@ export function wireChildLifecycle(ctx) {
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
         stdoutDiagnostics.record({ chunk, text });
+        if (lineStdout) {
+            lineStdout.feed({ chunk: text });
+            return;
+        }
         if (streamFormat === 'plain' && text.length > 0)
             userVisibleOutputSeen = true;
         if (bufferStdoutUntilClose) {
@@ -716,6 +736,7 @@ export function wireChildLifecycle(ctx) {
                 controlScanBuffer = '';
             }
             flushBufferedStdout();
+            lineStdout?.flush({});
             streamHandler?.flush();
             session.endSession();
             stdoutDiagnostics.flush();

package/dist/agent-executor/sanitized-line-stream.d.ts

@@ -0,0 +1,24 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export declare function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }: {
+    maxBytes: number;
+    sanitize: (required: {
+        fullText: string;
+    }) => string;
+    emit: (required: {
+        text: string;
+    }, optional?: Record<string, never>) => void;
+    onOverflow: (required: {
+        bytes: number;
+    }, optional?: Record<string, never>) => void;
+}, _options?: Record<string, never>): {
+    feed(required: {
+        chunk: string;
+    }, optional?: Record<string, never>): void;
+    flush(required: Record<string, never>, optional?: Record<string, never>): void;
+};
+//# sourceMappingURL=sanitized-line-stream.d.ts.map

package/dist/agent-executor/sanitized-line-stream.js

@@ -0,0 +1,45 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }, _options = {}) {
+    let parts = [];
+    let bytes = 0;
+    let overflow = false;
+    /** One line's fragments retain at most maxBytes; an oversized line is discarded through its end. */
+    function append(text) {
+        if (!text)
+            return;
+        bytes += Buffer.byteLength(text, 'utf8');
+        if (bytes > maxBytes) {
+            parts = [];
+            overflow = true;
+        }
+        if (!overflow)
+            parts.push(text);
+    }
+    /** Delivery happens once per completed line, or once for the final unterminated tail. */
+    function flush(newline) {
+        if (overflow)
+            onOverflow({ bytes });
+        else if (bytes > 0 || newline)
+            emit({ text: sanitize({ fullText: parts.join('') + newline }) });
+        parts = [];
+        bytes = 0;
+        overflow = false;
+    }
+    return {
+        feed({ chunk }, _optional = {}) {
+            const lines = chunk.split('\n');
+            lines.forEach((line, index) => {
+                append(line);
+                if (index < lines.length - 1)
+                    flush('\n');
+            });
+        },
+        flush(_required, _optional = {}) { flush(''); },
+    };
+}
+//# sourceMappingURL=sanitized-line-stream.js.map

package/dist/http/delegated-tools.d.ts

@@ -37,6 +37,8 @@ export interface DelegatedToolExecuteResponse {
  */
 export interface DelegatedToolsInternalErrorContext {
     readonly source: 'delegated-tool-execute' | 'resolve-principal';
+    /** Optional host-loaded recovery facts; the host describer must redact these as usual. */
+    readonly recoveryMessage?: string;
     readonly runId: string;
     readonly toolId: string;
     readonly correlationId: string;
@@ -50,6 +52,16 @@ export interface DelegatedToolsInternalErrorContext {
     readonly status?: 'timed-out' | 'cancelled' | 'failed';
 }
 export interface DelegatedToolsHttpDeps {
+    /** One bounded read after an interrupted call, for hosts whose jobs live in another process.
+     * Must authorize with the supplied principal, never execute a write/retry, and impose its own
+     * deadline. A throw is contained; absent facts remain unknown. No calls on the success path.
+     */
+    readonly recoverInterruptedTool?: (required: {
+        principal: Principal;
+        runId: string;
+        toolId: string;
+        result: ToolExecutionResult;
+    }) => Promise<string | undefined>;
     /** The same negotiated digest store supplied to the run lifecycle and agent executor. */
     readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly lifecycle: RunLifecycle;

package/dist/http/delegated-tools.js

@@ -130,7 +130,7 @@ function parseDelegatedToolExecute(input) {
  * vouches for this exact result via `deps.isModelSafeToolFailure` (it has already redacted the text
  * itself), in which case it is a `422 TOOL_EXECUTION_FAILED` carrying the host's text verbatim.
  */
-function toolExecutionResultToApiResult(deps, { runId, toolId, result }) {
+function toolExecutionResultToApiResult(deps, { runId, toolId, result, recoveryMessage }) {
     switch (result.status) {
         case 'completed': {
             const outcome = batchOutcomeFor({ output: result.output });
@@ -143,7 +143,7 @@ function toolExecutionResultToApiResult(deps, { runId, toolId, result }) {
             return err({ error: createApiError({ code: 'TOOL_OPERATION_DENIED', message: 'this operation was denied during confirmation' }) });
         case 'timed-out':
         case 'cancelled':
-            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error: result.status, runId, toolId, status: result.status }) });
+            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error: result.status, runId, toolId, ...(recoveryMessage ? { recoveryMessage } : {}), status: result.status }) });
         case 'failed':
             return err({ error: failedResultToApiError(deps, { runId, toolId, result }) });
         default: {
@@ -163,6 +163,21 @@ function failedResultToApiError(deps, { runId, toolId, result }) {
     }
     return reportInternalError(deps, { source: 'delegated-tool-execute', error: result.error ?? result.status, runId, toolId, status: 'failed' });
 }
+/** Read host-owned recovery facts once after interruption. The host supplies the deadline and
+ * permission-checked read; a failed read never replaces or retries the original operation.
+ * @complexity One optional bounded read; no extra work on successful executions.
+ */
+async function toolExecutionResultWithRecovery(deps, required) {
+    const { principal, runId, toolId, result } = required;
+    let recoveryMessage;
+    if (result.status === 'timed-out' || result.status === 'cancelled') {
+        try {
+            recoveryMessage = await deps.recoverInterruptedTool?.({ principal, runId, toolId, result });
+        }
+        catch { /* Recovery cannot change the interrupted write or expose its own failure. */ }
+    }
+    return toolExecutionResultToApiResult(deps, { runId, toolId, result, ...(recoveryMessage ? { recoveryMessage } : {}) });
+}
 /**
  * `POST /api/delegated-tool-calls` — executes one delegated tool call against an already-started
  * run. Maps `ToolExecutionResult.status` to the HTTP response via `toolExecutionResultToApiResult`
@@ -224,7 +239,7 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
                 input: input.input,
                 ...(signal !== undefined ? { signal } : {}),
             });
-            return toolExecutionResultToApiResult(deps, { runId: input.runId, toolId: input.toolId, result });
+            return toolExecutionResultWithRecovery(deps, { principal, runId: input.runId, toolId: input.toolId, result });
         }
         catch (error) {
             if (error instanceof ToolInputError) {

package/dist/http/frontend-control.d.ts

@@ -52,6 +52,10 @@ export interface CreateFrontendControlOptions {
     readonly resolveBindToken: (requiredArgs: {
         readonly request: RunCreateRequest;
     }) => string | undefined;
+    /** Authenticated owner of a run's originating surface when session ownership is enabled. */
+    readonly resolveBindOwner?: (required: {
+        readonly request: RunCreateRequest;
+    }) => FrontendSessionOwner | undefined;
     /** @default `@jini-ai/daemon`'s `denyAllFrontendCapabilityPolicy` — a host grants access explicitly. */
     readonly policy?: ToolPolicy;
     /** @default `@jini-ai/daemon`'s `DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS`. */

package/dist/http/frontend-control.js

@@ -100,7 +100,8 @@ export function createFrontendControl(requiredArgs, optionalArgs = {}) {
             return;
         let release;
         try {
-            release = registry.bindRunByToken({ runId: run.id, bindToken });
+            const owner = options.resolveBindOwner?.({ request });
+            release = registry.bindRunByToken({ runId: run.id, bindToken, ...(owner ? { owner } : {}) });
         }
         catch (error) {
             reportBindError({ runId: run.id, error });

package/dist/http/frontend-request-route.d.ts

@@ -0,0 +1,27 @@
+import type { Express, Request, Response } from 'express';
+import type { FrontendControl } from './frontend-control.js';
+import type { FrontendSessionOwner } from '../frontend-session-registry.js';
+import type { ToolExecutor } from '../tool-executor.js';
+export interface FrontendRequestRouteRequired {
+    readonly app: Express;
+    readonly path: string;
+    readonly control: Pick<FrontendControl, 'bindRequest'>;
+    readonly executor: Pick<ToolExecutor, 'execute'>;
+    /** Host must authenticate session, origin and the tab before returning an owner. */
+    readonly resolveOwner: (required: {
+        req: Request;
+        res: Response;
+    }) => Promise<FrontendSessionOwner | null>;
+    readonly capabilityIds: readonly string[];
+}
+/** Bind one authenticated request to its originating surface, then use the host's existing gates.
+ * @param required Host-authenticated owner, frontend control, gated executor and allowed ids.
+ * @param optional Injectable fresh request id. A caller never chooses a run id or principal.
+ * @returns Nothing; mounts one JSON-body route behind the host's authentication/body-limit middleware.
+ * @complexity O(allowed ids) setup; one binding and one execution per request, no storage or polling.
+ * @overallScore 100
+ */
+export declare function registerFrontendRequestRoute({ app, path, control, executor, resolveOwner, capabilityIds }: FrontendRequestRouteRequired, { newRequestId }?: {
+    newRequestId?: () => string;
+}): void;
+//# sourceMappingURL=frontend-request-route.d.ts.map

package/dist/http/frontend-request-route.js

@@ -0,0 +1,69 @@
+import { randomUUID } from 'node:crypto';
+import { streamToolExecution } from './tool-execution-routes.js';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Exact browser envelope: an agent cannot borrow a run or supply execution authority.
+ * @complexity O(input bytes) time and space for the frozen request; envelope has three keys.
+ * @overallScore 100
+ */
+function readFrontendRequest(body, allowed) {
+    if (!isRecord(body))
+        return null;
+    const value = body;
+    if (Object.keys(value).length !== 3)
+        return null;
+    if (typeof value.capabilityId !== 'string' || !allowed.has(value.capabilityId))
+        return null;
+    if (typeof value.bindToken !== 'string' || value.bindToken.length === 0)
+        return null;
+    if (!isRecord(value.input))
+        return null;
+    return { capabilityId: value.capabilityId, bindToken: value.bindToken, input: structuredClone(value.input) };
+}
+/** Bind one authenticated request to its originating surface, then use the host's existing gates.
+ * @param required Host-authenticated owner, frontend control, gated executor and allowed ids.
+ * @param optional Injectable fresh request id. A caller never chooses a run id or principal.
+ * @returns Nothing; mounts one JSON-body route behind the host's authentication/body-limit middleware.
+ * @complexity O(allowed ids) setup; one binding and one execution per request, no storage or polling.
+ * @overallScore 100
+ */
+export function registerFrontendRequestRoute({ app, path, control, executor, resolveOwner, capabilityIds }, { newRequestId = randomUUID } = {}) {
+    const allowed = new Set(capabilityIds);
+    app.post(path, async (req, res) => {
+        const request = readFrontendRequest(req.body, allowed);
+        if (!request) {
+            res.status(400).json({ error: 'Expected an allowed capabilityId, object input and frontend bindToken.' });
+            return;
+        }
+        let owner;
+        try {
+            owner = await resolveOwner({ req, res });
+        }
+        catch {
+            res.status(403).json({ error: 'The browser session could not be verified for this page action.' });
+            return;
+        }
+        if (!owner) {
+            res.status(403).json({ error: 'This page request has no authenticated browser owner.' });
+            return;
+        }
+        const runId = newRequestId();
+        const boundExecutor = {
+            execute: async (call, options = {}) => {
+                const signal = options.signal;
+                const release = control.bindRequest({ runId, bindToken: request.bindToken, owner, signal });
+                try {
+                    return await executor.execute(call, options);
+                }
+                finally {
+                    release();
+                }
+            },
+        };
+        await streamToolExecution({ req, res, executor: boundExecutor, call: {
+                executionId: runId, run: { id: runId }, principal: { id: owner.principalId }, toolId: request.capabilityId, input: request.input,
+            } }, { keepalive: true });
+    });
+}
+//# sourceMappingURL=frontend-request-route.js.map

package/dist/http/index.d.ts

@@ -59,4 +59,6 @@ export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
 export { tryRestoreSurface } from './surface-restoration.js';
+export { registerFrontendRequestRoute } from './frontend-request-route.js';
+export type { FrontendRequestRouteRequired } from './frontend-request-route.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -32,4 +32,5 @@ export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
 export { tryRestoreSurface } from './surface-restoration.js';
+export { registerFrontendRequestRoute } from './frontend-request-route.js';
 //# sourceMappingURL=index.js.map

package/dist/http/tool-execution-routes.d.ts

@@ -22,10 +22,10 @@
  * body that never completed never reaches the executor. Listeners are detached once the call
  * settles, so a long-lived keep-alive socket never accumulates them.
  */
-import { type ErrorRequestHandler, type RequestHandler } from 'express';
+import { type ErrorRequestHandler, type Request, type RequestHandler, type Response } from 'express';
 import type { ToolDescriptor } from '@jini-ai/core';
 import type { ToolExecutor } from '../tool-executor.js';
-import { TOOL_EXECUTIONS_ROUTE_PATH } from '../remote-tool-executor.js';
+import { TOOL_EXECUTIONS_ROUTE_PATH, type ToolExecutionWireRequest } from '../remote-tool-executor.js';
 export { TOOL_EXECUTIONS_ROUTE_PATH };
 export declare const TOOL_CATALOG_ROUTE_PATH = "/internal/tool-catalog";
 export declare const DEFAULT_TOOL_EXEC_TOKEN_ENV_VAR = "JINI_TOOL_EXEC_TOKEN";
@@ -62,6 +62,18 @@ export interface ToolExecutionRoutesOptional {
 }
 /** The token + loopback gate; mounted before any body parser. Exported for hosts that need it on another path. */
 export declare function requireToolExecutionCaller(_required: Record<string, never>, { tokenEnvVar, env }?: Pick<ToolExecutionRoutesOptional, 'tokenEnvVar' | 'env'>): RequestHandler;
+/**
+ * Streams one execution as NDJSON. Headers go out first; surfaces are written as they are emitted
+ * and are dropped once the call settled; exactly one terminal line follows.
+ */
+export declare function streamToolExecution({ req, res, call, executor }: {
+    readonly req: Request;
+    readonly res: Response;
+    readonly call: ToolExecutionWireRequest;
+    readonly executor: Pick<ToolExecutor, 'execute'>;
+}, { runWithContext, keepalive }: Pick<ToolExecutionRoutesOptional, 'runWithContext'> & {
+    keepalive?: boolean;
+}): Promise<void>;
 /**
  * Mounts both routes on `app` (an Express app or a `Router`). Mount it BEFORE any app-level
  * `express.json()` with a smaller limit: this route parses its own body after its gate, and an

package/dist/http/tool-execution-routes.js

@@ -99,7 +99,9 @@ function wireError(error) {
  * Streams one execution as NDJSON. Headers go out first; surfaces are written as they are emitted
  * and are dropped once the call settled; exactly one terminal line follows.
  */
-async function streamExecution({ req, res, call, executor }, { runWithContext }) {
+export async function streamToolExecution({ req, res, call, executor }, { runWithContext, keepalive = false }) {
+    if (res.destroyed)
+        return;
     const controller = new AbortController();
     // `res` 'close' (not `req` 'close', which fires as soon as a completed body was read) means the
     // caller went away; after a normal end `writableFinished` is already true and nothing aborts.
@@ -116,6 +118,9 @@ async function streamExecution({ req, res, call, executor }, { runWithContext })
         res.write(`${JSON.stringify(line)}\n`); };
     const emitSurface = async (emission) => { if (!settled)
         writeLine({ type: 'surface', emission }); };
+    // Human confirmation may outlive the proxy's idle-body timeout; never poll for an answer.
+    const heartbeat = keepalive ? setInterval(() => writeLine({ type: 'keepalive' }), 15_000) : undefined;
+    heartbeat?.unref();
     const run = () => executor.execute({ principal: call.principal, run: call.run, toolId: call.toolId, input: call.input }, { signal: controller.signal, emitSurface });
     try {
         if (!req.complete || controller.signal.aborted)
@@ -128,6 +133,8 @@ async function streamExecution({ req, res, call, executor }, { runWithContext })
     }
     finally {
         settled = true;
+        if (heartbeat)
+            clearInterval(heartbeat);
         res.off('close', onClose);
         req.off('error', onRequestError);
         res.end();
@@ -141,7 +148,7 @@ function executionHandler({ executor }, optional) {
             sendApiError({ res, status: 400, error });
             return;
         }
-        void streamExecution({ req, res, call, executor }, optional);
+        void streamToolExecution({ req, res, call, executor }, optional);
     };
 }
 /**

package/dist/session-coordination.d.ts

@@ -77,11 +77,18 @@ export interface FailingRunLifecycle {
     }, optional?: Record<string, never>): Promise<unknown>;
 }
 /** Emit the refusal reason on the run stream so the chat can show and save it. Event delivery
- * is best-effort; finishing remains mandatory even when the stream cannot accept the event. */
-export declare function failRunBeforeStart({ lifecycle, runId, message }: {
+ * is best-effort; finishing remains mandatory even when the stream cannot accept the event.
+ * Startup exceptions carry redacted stage/cause text through that same saved error event.
+ * @example failRunBeforeStart({ lifecycle, runId, message: 'Could not start.', startup: { stage: 'session binding', error } }, {});
+ */
+export declare function failRunBeforeStart({ lifecycle, runId, message, startup }: {
     lifecycle: FailingRunLifecycle;
     runId: string;
     message: string;
+    startup?: {
+        stage: string;
+        error: unknown;
+    };
 }, _optional?: Record<string, never>): Promise<void>;
 export interface AgentCapabilities {
     readonly resumesSessionViaCli?: boolean;

package/dist/session-coordination.js

@@ -1,3 +1,4 @@
+import { startupFailureMessage } from '@jini-ai/agent-runtime';
 /** Fresh private maps keep daemon instances independent. */
 export function createLiveRunTracker(_args, _optional = {}) {
     const runs = new Map();
@@ -82,10 +83,14 @@ export async function waitForStoppingRuns({ tracker, lifecycle, scheduler, conve
     }
 }
 /** Emit the refusal reason on the run stream so the chat can show and save it. Event delivery
- * is best-effort; finishing remains mandatory even when the stream cannot accept the event. */
-export async function failRunBeforeStart({ lifecycle, runId, message }, _optional = {}) {
+ * is best-effort; finishing remains mandatory even when the stream cannot accept the event.
+ * Startup exceptions carry redacted stage/cause text through that same saved error event.
+ * @example failRunBeforeStart({ lifecycle, runId, message: 'Could not start.', startup: { stage: 'session binding', error } }, {});
+ */
+export async function failRunBeforeStart({ lifecycle, runId, message, startup }, _optional = {}) {
+    const reason = startup ? startupFailureMessage(startup, {}) : message;
     try {
-        await lifecycle.emit({ runId: runId, input: { event: 'error', data: { message } } });
+        await lifecycle.emit({ runId: runId, input: { event: 'error', data: { message: reason } } });
     }
     catch { /* Finishing remains mandatory. */ }
     await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });

package/dist/tool-recovery/redaction.d.ts

@@ -77,6 +77,7 @@ export declare function isRedactedToolFailure({ result }: {
  * compiles against a published http-kit that predates `status`.
  */
 export interface DelegatedInternalErrorContext {
+    readonly recoveryMessage?: string;
     readonly source: string;
     readonly runId: string;
     readonly toolId: string;

package/dist/tool-recovery/redaction.js

@@ -97,7 +97,10 @@ function delegatedInternalErrorReason(context) {
  * @complexity O(reason length) for the redaction pass.
  */
 export function describeDelegatedInternalError({ context, ...deps }, _optional = {}) {
-    const { text, redactions } = deps.redactSecretShapes({ text: delegatedInternalErrorReason(context) });
+    let reason = delegatedInternalErrorReason(context);
+    if ((context.status === "timed-out" || context.status === "cancelled") && context.recoveryMessage)
+        reason = context.recoveryMessage;
+    const { text, redactions } = deps.redactSecretShapes({ text: reason });
     const errorId = deps.mintErrorId();
     safeOnFailure(deps.onFailure, {
         errorId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.19",
+  "version": "0.6.23",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -153,22 +153,22 @@
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
     "@jini-ai/db": "0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.19",
-    "@jini-ai/chat": "0.6.19",
-    "@jini-ai/core": "^0.6.19",
-    "@jini-ai/platform": "^0.6.19",
-    "@jini-ai/http-kit": "0.6.19",
-    "@jini-ai/protocol": "^0.6.19"
+    "@jini-ai/chat": "0.6.23",
+    "@jini-ai/core": "^0.6.23",
+    "@jini-ai/platform": "^0.6.23",
+    "@jini-ai/protocol": "^0.6.19",
+    "@jini-ai/agent-runtime": "^0.6.23",
+    "@jini-ai/http-kit": "0.6.22"
   },
   "dependencies": {
     "smol-toml": "1.9.1",
     "kysely": "^0.29.6",
-    "@jini-ai/core": "^0.6.19",
-    "@jini-ai/protocol": "^0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.19",
+    "@jini-ai/core": "^0.6.23",
     "@jini-ai/db": "^0.6.19",
-    "@jini-ai/platform": "^0.6.19",
-    "@jini-ai/http-kit": "^0.6.19"
+    "@jini-ai/protocol": "^0.6.19",
+    "@jini-ai/platform": "^0.6.23",
+    "@jini-ai/http-kit": "^0.6.22",
+    "@jini-ai/agent-runtime": "^0.6.23"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",